Malicious PDF — malware analysis report

Static analysis result for SHA-256 d13a3bae8dba5819…

MALICIOUS

PDF

66.2 KB Created: 2020-03-07 20:00:53 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2026-05-09
MD5: f1f9c047845e5184603f9c05e7e6bf46 SHA-1: 81963f8b8f39fca10377127ccc775b9360fbe1f0 SHA-256: d13a3bae8dba5819d4a20c3e805e88d5a76989a49708c1780a09f17e390e5768
116 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1566.002 Phishing: Spearphishing Attachment

The PDF document employs a lure by presenting itself as a 'Pinyin converter tone mark' tool, instructing the user to enable macros or editing to view its content. This is a common technique to bypass security measures. The document contains a large farm of external links, primarily pointing to other PDF files hosted on various domains, suggesting a link-based distribution or redirection strategy. No scripts were extracted, limiting further analysis of direct payload execution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://8uxk6.slpny.com/uploads/1/3/0/6/130622049/130622049.html#pinyin+converter+tone+mark PDF link annotation
    • http://mail.judithavers.com/uploads/1/3/0/3/130379060/zowubibu_bewojeza_benegopuduzize.pdfIn PDF document text
    • http://dominicbercier.com/uploads/1/3/0/4/130483256/sajupoxejok.pdfIn PDF document text
    • http://charltonelectricalservices.com/uploads/1/3/0/6/130605270/levanol.pdfIn PDF document text
    • http://gruporetolatino.com/uploads/1/3/0/7/130776162/xixetedelib.pdfIn PDF document text
    • http://twopeaspodcasts.com/uploads/1/3/0/5/130551775/920938.pdfIn PDF document text
    • http://vanessagallas.com/uploads/1/3/0/6/130620752/f8958.pdfIn PDF document text
    • http://oginnovate.com/uploads/1/3/0/6/130621901/8b261016.pdfIn PDF document text
    • http://enhancedbenefits.us/uploads/1/3/0/4/130488328/kulifix-fupurovepibore-sazix-dapufirejonuv.pdfIn PDF document text
    • http://opiniononline.net/uploads/1/3/0/5/130541188/a0c53680a31eb9.pdfIn PDF document text
    • http://cinemillion.com/uploads/1/3/0/7/130775274/zavobamuzezuf.pdfIn PDF document text
    • http://nutricionbasadaentrofologia.com/uploads/1/3/0/5/130551187/lupitipilovotevobuz.pdfIn PDF document text
    • http://retrotri.com/uploads/1/3/0/5/130545484/toguniboganuxumudu.pdfIn PDF document text
    • http://www.arabellabreckenridge.com/uploads/1/3/0/7/130739938/5515814.pdfIn PDF document text
    • http://sookeyhairextensions.com/uploads/1/3/0/7/130739924/12fca6.pdfIn PDF document text
    • http://rbfengenharia.net/uploads/1/3/0/2/130272978/b168e44.pdfIn PDF document text
    • http://mnixonsclassroom.com/uploads/1/3/0/4/130488244/rikojom.pdfIn PDF document text
    • http://agealive.net/uploads/1/3/0/6/130639054/nodukigutesaxaxomi.pdfIn PDF document text
    • http://acadiantax.com/uploads/1/3/0/5/130540159/muxalu.pdfIn PDF document text
    • http://cauler.com/uploads/1/3/0/6/130620949/fde24c67fe886d.pdfIn PDF document text
    • http://paravettemedics.com/uploads/1/3/0/3/130323794/e57298118e.pdfIn PDF document text
    • http://jso.tn.org/uploads/1/3/0/2/130273962/zubaditubomizos.pdfIn PDF document text
    • http://mannasweety.com/uploads/1/3/0/6/130639233/bunezemunakuniv.pdfIn PDF document text
    • http://tripledogdare.com/uploads/1/3/0/4/130476068/lupuboz.pdfIn PDF document text
    • http://scwaterfrontworks.com/uploads/1/3/0/7/130776889/2285137.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c230.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC230 8976 bytes
SHA-256: cba3a74a30f0f470b6660f5b6e37b204e0a1813300649b6719e2caa3b4ad11df
font_01_sfnt_off0000e441.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE441 6888 bytes
SHA-256: d2e966f4d26ec9d24db06929a1fba514b399dd43486d20d0ff389cf2ad0d20c9

Open this report in the interactive analyzer, or submit your own file for analysis.